How at the end the window size reduced to 32768 on the initiating side?

Why if the interface is set to GIG - it did not use the 14 as window scale ? but used 7?what could have determined that - is it a hard setting on server or did the TCP connection catch some buffer on the network?

1 Answer

The first thing to say is that the Windows Scaling Factor is only set by Option values in the SYN and SYN/ACK. You will see this in the TCP header of every packet simply because Wireshark is remembering the value for you and presenting it. You can tell that the value in the header is generated by Wireshark because it is enclosed in square brackets. All values in square brackets are generated fields rather than fields in the protocol.

Scaling factor shows the number of leftward bit shifts that should be used for an advertised window size. The affect is multiplication; an 8 bit shift being equivalent to a multiplication factor of 256. Therefore, for the server to determine the size of the client-side receive window, it should multiply the advertised size by 256.

Your trace shows that for data flowing from the server to the client, a scaling factor of 8 is applied to windows advertised by the client, and a scaling factor of 14 is applied to windows advertised by the server.

For part 2 of your question, I think you are muddling scaling factor with advertised window size. Scaling factor just tells the sender how to calculate the effective window size. The actual size can be any value from 0 up to 64k x the scaling factor.

What are the operating systems of the client and server?

Best regards...Paul

PS: Sorry for the length of this response. If I had more time I'd have made it shorter.

Comments

Thanks Paul.

starting with 2)
I understand that the scaling factor of 8 (or 7) is applied to client window and that of 14 is applied server window. Question is: what determines that scaling factor? what is it based on? why not both sides have the 14-bit scaling factor multiplication, since both have 1Gig ports?

i dont have exact operating system info, but i know its windows for both client and server

The scaling factor is related to the OS settings and not to the port speed.
The RFC related to the window scaling is the 1323 one and you can see examples for WinXP that was not supporting it but later on with registry modifications it was supported.
What also you should have in mind is that devices like proxies can modify the value of the scaling and window size.
Best Regards,
Yiannis

I feel like it has to be more that just the OS that decides the scaling factor. I do a Iperf test and my receiver has a scaling factor of 2 I do a online speed test and my receiver is 256 (same receiver both times) Why would they be different numbers?

Ps i am have throughput issues. Not trying to take over the conversation.